diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 3.0.2
+
+* Allow warp-tls to request client certificates. [#337](https://github.com/yesodweb/wai/pull/337)
+
 ## 3.0.1.4
 
 Add additional Diffie-Hellman RSA and DSA ciphers to warp-tls.
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -15,6 +15,8 @@
     , tlsLogging
     , tlsAllowedVersions
     , tlsCiphers
+    , tlsWantClientCert
+    , tlsServerHooks
     , defaultTlsSettings
     , tlsSettings
     , tlsSettingsMemory
@@ -81,6 +83,22 @@
     -- Default: '[TLSExtra.cipher_AES128_SHA1, TLSExtra.cipher_AES256_SHA1, TLSEtra.cipher_RC4_128_MD5, TLSExtra.cipher_RC4_128_SHA1]'
     --
     -- Since 1.4.2
+  , tlsWantClientCert :: Bool
+    -- ^ Whether or not to demand a certificate from the client.  If this
+    -- is set to True, you must handle received certificates in a server hook
+    -- or all connections will fail.
+    --
+    -- Default: False
+    --
+    -- Since 3.0.2
+  , tlsServerHooks :: TLS.ServerHooks
+    -- ^ The server-side hooks called by the tls package, including actions
+    -- to take when a client certificate is received.  See the "Network.TLS"
+    -- module for details.
+    --
+    -- Default: def
+    --
+    -- Since 3.0.2
   }
 
 -- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name.
@@ -94,6 +112,8 @@
   , tlsLogging = def
   , tlsAllowedVersions = [TLS.TLS10,TLS.TLS11,TLS.TLS12]
   , tlsCiphers = ciphers
+  , tlsWantClientCert = False
+  , tlsServerHooks = def
   }
 
 -- taken from stunnel example in tls-extra
@@ -175,7 +195,7 @@
   where
     get = getter tlsset sock params
     params = def {
-        TLS.serverWantClientCert = False
+        TLS.serverWantClientCert = tlsWantClientCert
       , TLS.serverSupported = def {
           TLS.supportedVersions = tlsAllowedVersions
         , TLS.supportedCiphers  = tlsCiphers
@@ -183,6 +203,7 @@
       , TLS.serverShared = def {
           TLS.sharedCredentials = TLS.Credentials [credential]
         }
+      , TLS.serverHooks = tlsServerHooks
       }
 
 ----------------------------------------------------------------
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.0.1.4
+Version:             3.0.2
 Synopsis:            HTTP over SSL/TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE